Robustness of the Bennett-Brassard 1984 quantum key distribution protocol against 

general coherent attacks 
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It is demonstrated that for the entanglement-based version of the Bennett-Brassard (BB84) quan- 
tum key distribution protocol, Alice and Bob share provable entanglement if and only if the estimated 
qubit error rate is below 25% or above 75%. In view of the intimate relation between entanglement 
and security, this result sheds also new light on the unconditional security of the BB84 protocol in 
its original prepare-and-measure form. In particular, it indicates that for small qubit error rates 
25% is the ultimate upper security bound for any prepare-and-measure BB84-type QKD protocol. 
On the contrary, for qubit error rates between 25% and 75% we demonstrate that the correlations 
shared between Alice and Bob can always be explained by separable states and thus, no secret key 
can be distilled in this regime. 

PACS numbers: 03.67.Dd, 03.65.Ud 



I. INTRODUCTION 

Quantum cryptography solves an outstanding problem 
of classical cryptography, namely the distribution of a se- 
cret perfectly correlated random key between legitimate 
users. The first quantum key distribution (QKD) pro- 
tocol, which was able to achieve this goal by exploit- 
ing characteristic quantum phenomena, was proposed by 
Bennet and Brassard [15 . This BB84 protocol is the pro- 
totype of a prepare-and-measure QKD protocol, which 
allows unconditionally secure key distribution between 
two legitimate users, Alice and Bob. Its security against 
an eavesdropper, Eve, is guaranteed by the peculiar fea- 
tures of the quantum mechanical measurement process 
0. Later, it was realized that the security of the BB84 
protocol is based on an effective entanglement shared be- 
tween Alice and Bob. In particular, it was shown that, 
from the point of view of Eve, the originally proposed 
prepare-and-measure scheme is equivalent to an associ- 
ated entanglement-based version of the BB84 protocol 
0, 0, t5, 6]. The security of this latter protocol is guar- 
anteed, for example, if the state of the entangled-qubit 
pairs shared between Alice and Bob is exponentially close 
to being a pure state. Then, according to Holevo's theo- 
rem, Eve's mutual information with the distributed key 
is exponentially small 13, 13| . 

This equivalence between a prepare-and-measure QKD 
protocol and its associated entanglement-based QKD 
protocol, has been exploited in various proofs of uncon- 
ditional security of the BB84 protocol 0, |E El- In- 
deed, that quantum entanglement is necessary for se- 
cret QKD, was also emphasized in a more general con- 
text, recently ^lll- Nevertheless, though with respect 
to unconditional security issues the prepare-and-measure 
and the entanglement-based forms of the BB84 proto- 
col are equivalent, as far as realistic implementations 
are concerned both schemes are quite different. Specif- 
ically, entanglement-based QKD protocols typically re- 
quire quantum memories and quantum computers for 
performing the entanglement purification, necessary for 



enforcing secrecy even in the presence of an arbitrary 
powerful eavesdropper. On the contrary, the correspond- 
ing prepare-and-measure schemes do not require this ad- 
vanced quantum technology, and are therefore realizable 
much more easily with present day technology. 

An important quantity characterizing the security of 
a QKD protocol is the threshold disturbance, i.e. the 
maximal disturbance or quantum bit error rate (QBER) 
which can be tolerated by Alice and Bob for being ca- 
pable of producing a secret, perfectly correlated random 
key. This maximal disturbance quantifies the robustness 
of a QKD scheme, and in general it depends not only 
on the eavesdropping strategy, but also on the algorithm 
(distillation protocol) Alice and Bob are using for post- 
processing their raw data . From the practical point of 
view, it is most interesting to know the threshold distur- 
bance of a given QKD protocol, with respect to the most 
general eavesdropping attacks which are consistent with 
the laws of quantum mechanics. For such general coher- 
ent attacks, it has been demonstrated, for example, that 
the prepare-and-measure scheme of the BB84 protocol 
is unconditionally secure up to QBERs of approximately 
20%, provided one uses appropriate error correction and 
privacy amplification protocols, which involve two-way 
classical communication Furthermore, it is also 

known that a simple intercept-resend attack can beat the 
BB84 protocol giving rise to QBERs > 25% [13. How- 
ever, so far it is unknown whether an arbitrary powerful 
eavesdropper, whose power is only limited by the general 
laws of quantum mechanics, is able to push the threshold 
disturbance below 25% [l[il[Il- 

In this paper we investigate the robustness of the BB84 
protocol, with respect to general coherent attacks by an 
adversary whose power is only limited by the fundamen- 
tal laws of quantum mechanics. As a main result, it 
is shown that for QBERs less than 25% Alice and Bob 
always share pairs of entangled qubits, even if Eve has 
performed a general coherent attack involving quantum 
memories and quantum computers. In other words, as 
far as the robustness of the protocol is concerned, the 
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coherent attacks do not seem to offer any advantage over 
cohective or incoherent attacks. For the entanglement- 
based version of the BB84 protocol our result implies that 
Alice and Bob can distribute a random secret key up to 
this QBER, provided they purify their corrupted pairs 
with the help of an entanglement purification protocol 
(EPP) This result also sheds new light onto the 

still open question of the maximal error rate that can be 
tolerated by a prepare-and-measure scheme of the BB84 
protocol [llL In particular, in view of the equiva- 
lence between the prepare-and-measure scheme and the 
entanglement-based version of the BB84 protocol, our 
result demonstrates that 25% is indeed the threshold 
disturbance for the prepare-and-measure scheme as well. 
Thus, in principle Alice and Bob are able to exploit these 
quantum correlations for the distillation of a perfectly 
correlated secret random key, by means of an appropri- 
ate classical distillation protocol which involves two-way 
classical communication 10, 11]. Furthermore, as long 
as Alice and Bob focus on their sifted key and manipu- 
late each qubit-pair independently, for QBERs between 
25% and 75% a secret-key distillation is impossible. In 
particular, in this case we show that the correlations 
shared between Alice and Bob can always be described 
by separable states and thus the necessary precondition 
for secret- key distillation is violated 0, 13 • 

This paper is organized as follows: For the sake of 
completeness in Sec. ^]we summarize briefly basic facts 
of the prepare-and-measure scheme and the equivalent 
entanglement-based version of the BB84 protocol, as far 
as they are significant for our subsequent discussion. In 
Sec. mil we present the proof of our main result while 
Sec. irVJ contains discussion and conclusions. 



II. BASIC FACTS ABOUT BB84 PROTOCOL 

In the prepare-and-measure BB84 protocol, Alice 
sends a sequence of qubits to Bob each of which is ran- 
domly prepared in one of the basis states { |0), |1)} or 
{ |0), |1)} which are eigenstates of two maximally con- 
jugate physical variables, namely the two Pauli spin op- 
erators Z and X. The eigenstates of Z, i.e. { |0), |1)}, 
and of X, i.e. { |0), |T)}, are related by the Hadamard 
transformation 
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i.e. \i) = li> = 0, 1). In the basis { |0), |1)}, 

the Pauli spin operators are represented by the matrices 



X = 
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1 



y = 



-i 

1 



Z = 



1 

-1 



(2) 



Bob measures the received qubits randomly in one of the 
two bases. Afterwards Alice and Bob apply a random 
permutation of their data, and publicly discuss the bases 
chosen, discarding all the bits where they have selected 



different bases. Subsequently, they randomly select half 
of the bits from the remaining random key (sifted key) 
and determine its error probability or QBER. If, as a re- 
sult of a noisy quantum channel or of an eavesdropper, 
the estimated QBER is too high, they abort the proto- 
col. Otherwise, they perform error correction and privacy 
amplification with one- or two-way classical communica- 
tion, in order to obtain a smaller number of secret and 
perfectly correlated random bits. 

It has been shown that, from the point of view of an ar- 
bitrarily powerful eavesdropper, this originally proposed 
prepare-and-measure form of the BB84 protocol is equiv- 
alent to an entanglement-based QKD protocol 
. This latter form of the BB84 protocol offers advantages 
in particular with respect to questions concerning its un- 
conditional security, and works as follows: Alice prepares 
each of, say 2n, entangled-qubit pairs in a particular Bell 
state [i^, say |$+) = ^( \OaOb} + |1a1b)) (where the 
subscripts A, B refer to Alice and Bob, respectively). Af- 
ter having applied Hadamard transformation on the sec- 
ond half of each pair of a subset of randomly chosen qubit 
pairs, she sends all the second halves of the 2n pairs to 
Bob. Due to channel noise and the presence of a possible 
eavesdropper, however, at the end of this transmission 
stage all the 2n entangled-qubit pairs will be corrupted. 
In fact, they will be entangled among themselves as well 
as with Eve's probe. 

In order to ensure secret key distribution even in the 
presence of such a powerful eavesdropper, first of all Alice 
and Bob perform a random permutation of all the pairs, 
thus distributing any influence of the channel noise or 

the eavesdropper, equally among all the pairs ilia. Af- 

terwards, they perform a verification test, in which they 
randomly select half of the pairs ^3 as check pairs and 
measure each one of them independently, along a common 
basis, i.e. the quantization axis of the Bell state 1$+). 
However, these measurements are done only after Bob 
has reversed Alice's randomly applied Hadamard trans- 
formations. For this latter purpose, after the transmis- 
sion stage of the protocol, Alice has to announce publicly 
the qubits on which she has applied Hadamard transfor- 
mations. Subsequently, the influence of channel noise or 
of an eavesdropper is quantified by the average QBER of 
these n check pairs, i.e. the probability with which Al- 
ice's and Bob's measurement results disagree. Note that, 
since Alice and Bob perform their measurements along 
the quantization axis of the Bell state 1$^), in the ab- 
sence of noise and eavesdropping their measurement re- 
sults would perfectly agree. Furthermore, assuming that 
the check pairs constitute a fair sample |il7j , one may con- 
clude that the same QBER applies also to the remaining, 
yet unmeasured, n pairs. After this verification test all 
the check pairs are dismissed and, if the QBER is too 
high, the protocol is aborted. Otherwise, Alice and Bob 
proceed to the purification of the remaining n pairs 

For this purpose, they apply an appropriate entangle- 
ment purification protocol (EPP) 14, T^ with classical 
one- or two-way communication, so that they are able 
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to distill a smaller number of almost pure entangled- 
qubit pairs. Finally, measuring these almost perfectly 
entangled-qubit pairs in a common basis, i.e. along the 
quantization axis of the Bell state l^"^), Alice and Bob 
obtain a perfectly correlated random key, about which 
an adversary has negligible information. For the sake 
of completeness we finally want to mention that this 
entanglement-based protocol can be reduced to an as- 
sociated prepare-and-measure BB84 protocol with error 
correction and privacy amplification involving one- or 
two-way classical communication, only if the underlying 
EPF fulfills certain consistency conditions which are of 
no concern for our further discussion |^ 0, ^ . 

On the basis of the equivalence of these two forms of 
the BB84 protocol, it has been demonstrated that by 
means of one-way classical distillation protocols a ran- 
dom key can be exchanged secretly between the two le- 
gitimate users up to a QBER of approximately 11% 0. 
Furthermore, post-processing that involves two-way clas- 
sical communication can guarantee the extraction of a se- 
cret key even up to QBERs of the order of 20% [TollTTI|. 
On the other hand, it is also known that an intercept- 
resend attack can always defeat the BB84 protocol (irre- 
spective of the distillation protocol employeed by Alice 
and Bob) for QBERs above 25% However, as far 

as QBERs between 20% and 25% are concerned, it is 
still an open question whether Alice and Bob are able to 
exchange a secret key, under the assumption of general 
coherent attacks. 



established between Alice and Bob during the state dis- 
tribution cannot be explained by a separable state 0, 1^ ■ 
Throughout this work, we consider that Alice and Bob 
focus on the sifted key during the post processing (i.e., 
they discard immediately all the polarization data for 
which they have used different bases) and that they treat 
each pair independently. Thus, according to the afore- 
mentioned precondition, given a particular value of the 
estimated QBER, the task of Alice and Bob is to in- 
fer whether they share provable entanglement or not. 
Thereby, entanglement is considered to be provable if 
Alice's and Bob's correlations cannot be explained by 
a separable state within the framework of the protocol 
considered. In this section we demonstrate for the BB84 
protocol that, as long as the detected QBER is less than 
25% or larger than 75%, Alice and Bob can be confident 
that they share entangled-qubit pairs with high proba- 
bility. Furthermore, for QBERs between 25% and 75% 
the correlations between Alice and Bob can always be 
explained by a separable two-qubit state. 



III. ENTANGLEMENT AND THRESHOLD 
DISTURBANCE OF THE BB84 PROTOCOL 

According to a recent observation, a necessary precon- 
dition for secret key distillation is that the correlations 



Adopting the entanglement-based version of the BB84 
protocol we described in the previous section, the aver- 
age disturbance that Alice and Bob estimate during the 
verification test is given by 0, IT9| 
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where © denotes addition modulo 2. Thereby pab de- 
notes the reduced density operator of Alice and Bob for 
all 2n pairs while the index ji indicates that the corre- 
sponding physical observable refers to the ji-th randomly 
selected qubit pair. The powers of the Hadamard trans- 
formation TC'', with b G {0, 1}, reflect the fact that the 
errors in the sifted key originate from measurements in 
both complementary bases which have been selected ran- 
domly by Alice and Bob with equal probabilities. 

Recall now that Alice and Bob have permuted all their 
pairs randomly before the verification stage. This ran- 
dom permutation has the effect of distributing the errors 
introduced by Eve, over all the qubit pairs in a homo- 



geneous way I5I, (Tll| . As a result of this homogenization 
procedure all the reduced density operators describing the 
state of each pair shared between Alice and Bob become 
equal, i.e. 



Pab 



(2) 

Pab 



(2n) 

Pab- 



(4) 



The reduced density operator of Alice's and Bob' s fc-th 
pair is denoted by p^g = Tr^ {pab ) and Tr|^ indicates 
the tracing (averaging) procedure over all the qubit pairs 
except the fc-th one. Note that in general pab is ex- 
pected to have a complicated structure as it includes all 
the effects arising from a general coherent attack of a 
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possible eavesdropper. As a result of the homogenization 
procedure, however, the reduced states of the pairs 



where Tr^^^ denotes the tracing procedure over the ji- 
th qubit pair of Alice and Bob. According to Eq. ||SJ|, 
and in view of the homogenization procedure, the QBER 
is determined by the average error probability of an arbi- 
trary qubit pair, say the pair ji. Thus, the corresponding 
reduced density operator p'^ig contains all the necessary 
information about the noisy quantum channel and about 
a possible general coherent attack by an eavesdropper, 
which is relevant for the evaluation of the average QBER. 

In particular, this implies that an arbitrary attack by an 

(71) 

eavesdropper which gives rise to a particular state p^g is 
indistinguishable, from the point of view of the estimated 
average disturbance, from a corresponding individual at- 
tack which results in a decorrelated n-pair state of the 

form ^tiPAB- 

In order to address the problem for which values of the 

QBER the reduced density operator p^g is entangled, we 
start from the observation that the QBER of Eq. ^ is 
invariant under the transformations 

{l,b) ^ (/®1,6), 

{l,b) ^ (;,6©1). (6) 

This invariance implies that there are various reduced 
density operators of the ji-th qubit pair, which all give 
rise to the same observed value of the QBER. This can 
be seen from the elementary relations 

xn''\i){i\n''x = ■H''\i®i®b){i®i®b\n\ 
zn''\i){i\n''z = ■H''\i®b){i®b\n\ 
xzn^\i){i\H^zx = Ti!'\i®i){i®i\n\ (7) 

Together with the invariance of the QBER under the 
transformations (jSJ, these relations imply that the re- 

duced operators p^g and 

P^-AB = ^ E U{h)U{g)p'-iiu{g)^U{h)^ (8) 
I 



are equal and thus the average estimated disturbance (PJ 
reads 



(5) 

I 

give rise to the same value of the QBER. Thereby, the 
unitary and hermitian operators 

U{gi) = Xa®Xb, 
U{g2) = Za®Zb, 

Uigs) = -yA®yB = XAZA®XBZB, 

Uigi) = 1a® Is, (9) 

and 

Uihi) = Ha^-Hb, 

U{h2) = 1a® Is, (10) 

have been introduced, which form unitary representa- 
tions of two discrete Abelian groups Qi — {ffi, 32, <?3, 54} 
and G2 = {hi, Invariance of p^^' under these groups 
is induced by the symmetry transformations of Eq.@ 
which leave the QBER invariant. 

As a consequence of Eq. (jHl , the density operator p'^^g 
(71 ) 

is entangled if p^^^ is entangled, as both states are re- 
lated by local unitary operations and convex summation. 
Hence, to determine the values of the QBER for which 
Alice and Bob share provable entanglement, it suffices to 
determine the QBERs for which the most general two- 

qubit state p^^g (which is invariant under the Abelian 
discrete groups Gi and G2) is entangled. 

Note now that, the hermitian operators U{gi) and 
U{g2) of the group Gi constitute already a complete set of 
commuting operators in the Hilbert space of two qubits. 
Their eigenstates are given by the Bell states Thus, 
the most general two-qubit state which is invariant under 
the Abelian group Gi is given by a convex sum of Bell 
states, i.e. 
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pfj= Aoo|$+)($+| +Aio|$-)($-| +Aoi|*+)(*+| +Aii|*-)(*-|. (11) 

I 

Thereby, the non-negative parameters Xap have to fulfill the normalization condition 

E = 1- (12) 

a,/3e{0,l} 
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Furthermore, additional invariance of the quantum state 
under the discrete group Q2 imphes that 

Aoi = AiQ. (13) 

As a consequence of this last constraint and the normal- 
ization condition, only two of the four parameters Xa/s are 
independent. According to Eq.©, the average QBER is 
related to these parameters by 

QBER = All +A01. (14) 

Let us now determine the possible values of the QBER 
for which Alice and Bob share provable entanglement. To 
this end, we can take advantage of the Peres-Horodecki 
criterion, for example, stating that the state is dis- 
entangled iff its partial transpose is non-negative l2(i |. In 
our case, this condition is equivalent to the inequalities 

Aoi + All >| Aoo - Aio I, (15) 
Aoo + Aio >| Aoi-Aii I, (16) 

As depicted in Fig. ^ these inequalities, combined 
with Eqs. H12fl and (|13|l . imply that the reduced den- 

I 



aAB{D) = {4D-l)^+\l-2D\ ^ 

fce{o,i} 



Thereby, D = QBER, I4 denotes the unit operator in 
(g> C| and = i ( \Oc){kc\ + |lc)((l ® k)c\ ) • 
The family H17|l is parameterized by the estimated av- 
erage disturbance detected by Alice and Bob. Moreover, 
any separable state which belongs to this family is in- 
distinguishable, from the point of view of the estimated 
QBER, from the real state shared between Alice and Bob. 
In other words, whenever the detected QBER is between 
1/4 and 3/4, the correlations shared between Alice and 
Bob can be very well described in the framework of the 
family of sgjarable states (tab(-D). The necessary pre- 
condition [3, H, I23 for secret key distillation is not met 
for disturbances within this regime, so that the protocol 
must be aborted. 



IV. DISCUSSION AND CONCLUSIONS 

We have discussed the threshold disturbance of the 
BB84 QKD protocol under the assumption of general co- 
herent attacks which are only limited by the fundamen- 
tal laws of quantum theory. If Eve disentangles Alice 
and Bob by such a general attack (i.e., Alice's and Bob's 
correlations can be explained by a separable state) this 
gives rise to QBERs between 25% and 75%. Hence, if 



sity operator p^^g is entangled if the estimated QBER is 
below 1/4 or above 3/4. Given, however, that the states 

p^^j'' and p^^^ are related via local operations and convex 

summation, the original single-pair state /o^^j'' must also 
be entangled in the same regime of parameters. Hence 
we may conclude that, whenever Alice and Bob detect an 
average QBER within this interval, they can be confident 
that they share entanglement with high probability, and 
their correlations cannot originate from a separable state. 
The necessary precondition for secret-key distillation is 
therefore fulfilled. 

Let us now consider average QBERs with 1/4 < 
QBER < 3/4. The fact that p[ig is separable does not 
necessarily imply that p'^^g is also separable. But it indi- 
cates that in this regime of parameters, Alice's and Bob's 
correlations within the framework of the BB84 protocol 
can be explained by a separable state, namely by p^^'. 
According to 0, ll| , this implies that Alice and Bob can- 
not extract a secret key. A particularly simple family of 
such separable states defined for 1/4 < QBERs < 3/4, 
for example, is given by 



(17) 

I 

Alice and Bob detect a QBER within this interval, they 
have to abort the protocol. As an example, we presented 
a particular class of separable states which is capable 
of describing the correlations shared between Alice and 
Bob for 25% < QBER < 75%. For QBERs below 25% 
and above 75% the two legitimate users can be confident 
that with high probability the quantum correlations they 
share cannot be described by separable states. 

The relevance of our results in the context of the 
entanglement-based version of the BB84 protocol is ap- 
parent : Alice and Bob are able to extract a secret key 
for QBERs < 25% and QBERs > 75% by apphcation of 
an EPF which purifies towards the Bell states |$+) or 
1 5*^), respectively. 

However, for the prepare-and-measure forms of the 
BB84 protocol there are still open questions. So far, the 
highest tolerable error rates that have been reported in 
the context of general coherent eavesdropping attacks are 
close to 20% ESini- Nevertheless, according to a recent 
observation [3j Q i a. necessary precondition for secret-key 
distillation is that the correlations established between 
Alice and Bob during the state distribution cannot be 
explained by a separable state. In view of this strong 
link between quantum and secret correlations, our results 
suggest that in principle the distillation of a secret key 
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FIG. 1: Regions of the independent parameters D — QBER 
and G = Aoo — Aio for which the qubit pair state p^^g is 
separable (shaded regions). The various constraints that these 
parameters have to satisfy, are indicated by straight dashed 
lines, namely (a) Eq. lIT^ : (b) Aoo,Aio > 0; (c) Eqs. lIT^ . 
itni and lEBJl; (d) Aoi,Aii > and Eqs. JHl, The 
protocol operates in the region which is defined by the solid 
hnes. The threshold disturbances are indicated by black dots 
while the dot-dashed line connecting these dots corresponds 
to the family of separable states (1171 . 

is in principle possible for QBERs below 25% and above 
75%. In fact, if we focus on low disturbances, we can say 
that 25% is the upper bound on the maximal QBER that 
can be tolerated by any BB84-type prepare-and-measure 
QKD protocol. In other words, as far as the robustness 
of the BB84 protocol is concerned, coherent attacks do 
not seem to offer any advantages over collective or even 
incoherent attacks. Nevertheless, finding error correction 
and privacy amplification protocols required for a BB84- 
type protocol to be capable of meeting this upper security 
bound remains an open problem and will be addressed 
in subsequent work. 

Finally, it should be stressed that the disturbance 
thresholds we have obtained depend on the post- 
processing of the BB84 QKD protocol. In particular, 
they rely on the complete omission of those qubits of the 
raw key for which Alice and Bob measured in different 
bases. Furthermore, they also rely on the fact that Alice 



and Bob manipulate each qubit pair separately. At first 
sight it might appear to be puzzling why, under the same 
assumptions, it was shown that a secret key can be dis- 
tilled in the framework of the BB84 protocol for QBERs 
up to about 30%, by means of advantage distillation pro- 
tocols. These results, however, have been obtained under 
the additional assumption that Eve is restricted to so- 
called "optimal incoherent attacks", i.e. attacks which 
maximize Eve's information gain. One can easily ver- 
ify, for example, that the class of separable states l(T7|l 
is not optimal (in the sense of HEI). In our work we 
allow for arbitrary eavesdropping attacks and thus we 
have demonstrated that the distillation of a secret key for 
QBERs above 25% is impossible 0, ISJ23- So, although 
the incoherent attacks considered in 9, zl\ are optimal 
with respect to the information gain of an eavesdropper 
0, they are not able to disentangle Alice and Bob at 
the lowest possible QBER (that is at 25%). The cost of 
information loss that Eve has to accept by employing an 
attack that disentangles Alice and Bob at each particu- 
lar disturbance between 25% and 75% remains an open 
question. Clearly, to this end one has to consider in detail 
the eavesdropping attack and this is beyond the purpose 
of this work. 

Nevertheless, in principle the distillation of a secret 
key for QBERs above 25% is possible, provided that Al- 
ice and Bob do not focus on their sifted key only. In this 
context it was demonstrated with the help of entangle- 
ment witnesses recently, that the detection of quantum 
correlations between Alice and Bob is feasible even for 
QBERs above 25%, provided the data of the raw key are 
also taken into account 
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